avg count for last 4 days

[rameshlpatel]

Hi,

I have chart which showing application processed events in 24 hrs time range with span=1m. In same chart i have requirement to add history line chart of last 4 days avg processed events on same time (minute wise).

So here my problem is to create avg of last 4 days and show in same line chart for current day.

[martin_mueller]

Take a look at this:

index=_internal | timechart span=1m count | eval hms = strftime(_time, "%H%M%S")
| stats latest(_time) as _time latest(count) as count avg(count) as average values(_span) as _span by hms
| fields - hms | sort + _time

Run over the last four days this will produce two values for each time bucket in the last 24 hours, the average over four days and the most recent value. Format the chart to show the average as an overlay line over the count and you should be there.